Oracle WebCenter Content CVE-2026-60449

Exploitation requires the attacker to already possess a valid logon to the infrastructure where Oracle WebCenter Content executes (AV:L) - i.e., an OS-level, application-tier, or integration session on the host - after which no additional application privileges (PR:N), no user interaction (UI:N), and only low attack complexity (AC:L) are needed to reach the vulnerable Content Server component. The exposure is limited to the two supported versions 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factor is that this is NOT remotely reachable over the network from an unauthenticated position: an attacker without any host/infrastructure logon cannot exploit it, which sharply narrows the realistic attacker population to insiders or those who have already breached the middleware host.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, score 7.1) describes a locally-reachable but low-complexity attack requiring no application privileges or user interaction, yielding high confidentiality impact with no integrity or availability effect. Per the precision rules, PR:N formally denotes unauthenticated, yet Oracle's own phrasing 'attacker with logon to the infrastructure where Oracle WebCenter Content executes' means a valid host/network logon session is a practical prerequisite - the AV:L designation is the key limiting factor and substantially lowers real-world exploitability versus a network-facing bug. EPSS is not provided, KEV status is negative, and no POC is referenced, so there is no evidence of active or automatable exploitation; the realistic priority is moderate - patch in the normal CPU cycle rather than emergency response, but note the S:C scope change and 'Authentication Bypass' tag raise the ceiling on blast radius if an attacker already has a foothold on the middleware host. Missing data: no EPSS, no SSVC decision, and no CWE, so automatability and exploitation-status signals must be inferred from the CVSS vector alone.

An attacker who has obtained a foothold on the server infrastructure hosting Oracle WebCenter Content - for example a low-privilege OS/application account or a compromised integration credential - invokes the vulnerable Content Server code path to bypass authorization checks and read content and connected-system data they were never granted, exfiltrating sensitive documents. Because the vector is local (AV:L) with low complexity and no user interaction, the action is straightforward once host access exists, though no public exploit code is identified at time of analysis.